Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2024 13:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
120 seconds
General
-
Target
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe
-
Size
39KB
-
MD5
b7bfb490147c56a3f3480101df954fa9
-
SHA1
faaf01d73a5c7e7a65c9553c1e9ff0d7256a2624
-
SHA256
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4
-
SHA512
277ddfdb46fc81f00a76dc765562728737918b6f2f50def5d5201c730350c9c74a1632a3f6c884e7984271b088e6dd713763e6d856ceaf3819a63b07c5db9ee9
-
SSDEEP
768:VvASIisql251c6opnV0jZJ/s8B8RnVMZ8pBz3bdHUCRKSBsL+DEplyLnEI:inql2ncFpngZFsrKcZRKSCL+D+w9
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Platinum
Botnet
loshara
C2
127.0.0.1:80
Mutex
Client.exe
Attributes
-
reg_key
Client.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Drops startup file 3 IoCs
Processes:
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe\" .." 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe\" .." 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exepid Process 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exedescription pid Process Token: SeDebugPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: 33 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe Token: SeIncBasePriorityPrivilege 4892 2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe"C:\Users\Admin\AppData\Local\Temp\2e29fc015c30f726fb2c8fe8a687638cd523ceeb51a79d068b45cd61ac1b00b4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892